• No results found

COMPANY PROCESS / REQUEST TYPE

In document THE TRANSPARENCY REPORTING TOOLKIT (Page 81-98)

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Amazon Subpoenas Full Response (#)

Full response means that Amazon responded to valid legal process by providing all of the information requested.

Search Warrants

Other Court Orders

Subpoenas

Partial Response (#)

Partial response means that Amazon responded to valid legal process by providing only some of the information requested.

Search Warrants

Other Court Orders

Subpoenas

No Response (#)

No response means that Amazon responded to valid legal process by providing none of the information requested.

Search Warrants

Other Court Orders

AOL Report does not disclose data on responses to / compliance with requests.

Apple

Number of Device

Requests

Where Some Data

Was Provided

The number of law enforcement requests that resulted in Apple providing relevant device information, such as registration, subscriber, service, repair, and purchase information in response to valid legal process.

Percentage of

Device Requests

Where Some Data

Was Provided

The percentage of law enforcement requests that resulted in Apple providing some relevant device information in response to valid legal process.

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Apple (Cont’d) Number of Account Requests

Where No Data Was

Disclosed

The number of law enforcement requests that resulted in Apple providing no customer information whatsoever.

Number of Account

Requests

Where Apple

Objected

The number of law enforcement requests that resulted in Apple refusing to provide some data based on various grounds, such as jurisdiction, improper process, insufficient process, invalid process, or where the scope of the request was excessively broad. For example, Apple may object to a law enforcement request as “invalid” if it were not signed.

Number of Account

Requests

Where NonContent

Data Was Disclosed

The number of law enforcement requests that resulted in Apple providing only subscriber or transactional information, but not content. For example, Apple may provide subscriber information and a limited purchase history in response to valid legal process.

Number of Account

Requests

Where Some

Content Was Disclosed

The number of law enforcement requests where Apple determined that an account request was lawful and provided content such as iCloud email, contacts, calendar, or Photo Stream content. Apple only provides user account content in extremely limited circumstances.

Percentage of

Account Requests

Where Some Data

Was Disclosed

The percentage of law enforcement requests that resulted in Apple providing some iCloud, iTunes, or Game Center data.

Number of

Accounts

For Which Data Was

Disclosed

The number of discernible accounts, based on specific Apple IDs, email addresses, telephone numbers, credit card numbers, or other personal identifiers, for which Apple provided some iCloud, iTunes, or Game Center

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

AT&T

Demands Rejected/Challenged (#) (#)

We ensure that we receive the appropriate type of demand for the information requested. In this category, we include the number of times we rejected a demand or provided only partial information or no information in response to a demand.

Demands Partial or No Information (#)

Here are a few reasons why certain demands fall into this category:

• The wrong type of demand is submitted by law enforcement. For instance, we will reject a subpoena requesting a wiretap, because either a probable cause court order or search warrant is required.

• The demand has errors, such as missing pages or signatures.

• The demand was not correctly addressed to AT&T.

• The demand did not contain all of the elements necessary for a response. • We had no information that matched

the customer or equipment information provided in the demand.

Automattic Percentage of requests

where some or all

information was produced

Cheezburger Total Complied (#)

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

CloudFlare Subpoenas answered (#)

The data presented below covers the period from July 1, 2014 to December 31, 2014. So, for example, a request received in June 2014, but not processed until July 2014 will show as both “Requests received” and “Requests in process.”

Also, requests for which we are waiting for a response from law enforcement before moving forward may also be reflected in “Requests in process.” Court orders Search warrants Pen register/Trap and trace (PRTT) orders Wiretap orders Subpoenas in process (#) Court orders Search warrants Pen register/Trap and trace (PRTT) orders Wiretap orders

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

CREDO Mobile (Cont’d) Number of governmental requests

for which customer

communication content information requested (including wiretap requests) was produced Number of customer accounts

for which customer

information was produced DigitalOcean Subpoenas Request still in process (#)

Request has been received by DigitalOcean but is awaiting further processing or for a response from law enforcement.

ECPA Court Order

Search Warrant

Wiretap or PRTT

Imminent Harm

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

DigitalOcean (Cont’d) Subpoenas

No Data Found (#) The user account information either doesn’t exist or has been deleted. ECPA Court Order

Search Warrant Wiretap or PRTT Imminent Harm Subpoenas Rejected / No Information Provided (#)

1) The request was duplicative of a request we already responded to

2) DO objected to the request

3) Law enforcement withdrew the request 4) The request failed to include enough information

5) The request expired

ECPA Court Order

Search Warrant Wiretap or PRTT Imminent Harm Subpoenas Only NCD disclosed (#)

“Non-content data” such as basic subscriber information including the information captured at the time of registration such as an alternate email address, name, IP address,

--- Continued on next page ---

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

DigitalOcean (Cont’d)

Wiretap or PRTT Only NCD disclosed (#) (Cont’d) Imminent Harm Subpoenas Content Disclosed (#)

Data that our users generate including copies of Droplets, files on backup, or words in emails to customer support.

ECPA Court Order

Search Warrant

Wiretap or PRTT

Imminent Harm

DreamHost Percentage of requests complied ... the percentage of requests we complied with where partial data was produced.

Dropbox

To each warrant

Does not exist (#)

Account did not exist: This means that law enforcement specified an account in their request, but that account did not exist. To each account

listed (in warrants)

To each subpoena

Does not exist (#)

To each account

listed (in subpoenas)

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Dropbox (Cont’d) To each subpoena Content produced

(#) When we provide “content” information in

response to valid legal process, that means we provided the files stored in a person’s Dropbox account, in addition to non-content information.

To each account

listed (in subpoenas)

Court orders Content provided (#)

To each warrant

Content and non- content produced (#)

To each account

listed (in warrants)

To each subpoena

Non-content produced (#)

When we provide “non-content” information in response to valid legal process, that means we provided subscriber information such as the name and email address associated with the account; the date of account creation and other transactional information like IP addresses. “Non-content” information does not include the files that people store in their Dropbox accounts.

To each account

listed (in subpoenas)

Court orders Non-content provided (#)

To each warrant

No information provided (#)

This means that we didn’t provide any information in response to the request for one or more of the following reasons: (1) the request was duplicative of a request that we already responded to; (2) Dropbox objected To each account

listed (in warrants)

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Evernote Criminal requests from US governmental entities Responded with Data (#)

... the number of requests to which we responded by disclosing user data.

Facebook

Total Requests

where some data

produced (%) Search Warrant

Subpoena

Emergency Disclosures

Court Order (18 USC § 2703(d)]

Court Order (Other)

Pen Register/Trap and Trace Title III GitHub Percentage of Requests Where Information was Disclosed

There are several reasons why information may not be disclosed in response to a legal request. It may be that we do not have the requested data. It may be that the request was too vague such that we could not identify the data, or that it was otherwise defective. Sometimes the requesting party may simply withdraw the request. Other times, the requesting party may revise and submit another one. In cases where one request was replaced with a second, revised request, we would count that as two separate requests received. However, if we responded only to the revision, we would count that only as having responded to one request. Percentage of

Requests Nothing Disclosed

Percentage of Requests Some or All Requested Information Disclosed

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Google Percentage of Requests Where Some Data Produced

We report percentages for criminal requests from July 2010 onward. Those percentages reflect the number of requests we responded to by producing some information.

Inflection US Govt. Subpoenas Produced some info (#) US Civil Subpoenas US Search Warrants Emergency requests % of all demands produced at least some customer information

Internet Archive User accounts for which data was handed over (#)

Kickstarter

Subpoenas

we released some

information in response (#)

Of the 8 requests, 3 were in the form of subpoenas, and we released some information in response. We did not produce any information in response to the other 5 requests.

Other requests we did not produce any information (#) LinkedIn Percentage of Requests to which LI Provided Some Data

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Medium Report does not disclose data on responses to / compliance with requests.

Microsoft

[for all processes, in aggregate]

% Disclosed

Content

The number of court orders found to be lawful, and therefore at least some customer content was disclosed. Such content could include the subject or body of an email, photos stored in OneDrive, address book information, and calendars. In most cases, a court order that requires the disclosure of customer content will also require the disclosure of non-content data (see definition below).

[for all processes, in aggregate]

% Only Subscriber /

Transactional Data

The number of law enforcement requests determined to be lawful, and therefore only non-content information was disclosed. Non- content information could include the user’s name, billing address, IP history, etc. [for all processes, in

aggregate] % No Data Found

The number of law enforcement requests and/or court orders where our Compliance Team found no data in our systems related to the request and/or order, and therefore disclosed no customer information to law enforcement.

[for all processes, in

aggregate] % Rejected

The number of law enforcement requests and/or court orders rejected because we determined they failed to satisfy the relevant legal requirements, or where we successfully redirected law enforcement to obtain the information directly from the customer. As a result, no customer data of any kind was disclosed.

Nest Report does not disclose data on responses to / compliance with requests.

Pinterest Federal

Compliance w/ partial or full production (%)

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Pinterest (Cont’d) State/Local Compliance w/ partial or full production (%) Civil Requests Compliance w/ partial or full production (%) Reddit

# of requests where some info

was disclosed

% of requests where some user info was disclosed

Silent Circle Number of Users’

Data/Metadata Surrendered

Slack Report does not disclose data on responses to / compliance with requests.

Snapchat Percentage of requests

where some data

was produced

Sonic Total Number of Data Surrendered SpiderOak

Number of User’s

Data Surrendered

Rate of User’s Data Surrendered

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Time Warner Cable

[for all processes, in aggregate]

No Data Disclosed (%)

[for all processes, in aggregate]

Only Subscriber Information (%)

[for all processes, in aggregate]

Disclosed Content (%)

Tumblr

% Account Data Produced

% Blog Content Produced

[for all processes, in aggregate]

Something Produced (%)

[for all processes, in aggregate]

Nothing Produced (%)

In cases where no content or data was produced, the requests may have been withdrawn, or were defective, or we may have objected to the requests on legal grounds.

Twitter [for all processes, in aggregate]

percentage where

some information produced

We may not comply with requests for a variety of reasons. For example:

• We do not comply with requests that fail to identify a Twitter account.

• We may seek to narrow requests that are overly broad.

• In other cases, users may have challenged the requests after we’ve notified them.

Verizon % of demands we received rejected as invalid

We might reject a demand as legally invalid for a number of reasons, including that a different type of legal process is needed for the type of information requested. When we reject a demand as invalid, we do not produce any information.

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Wickr Report does not disclose data on responses to / compliance with requests.

Wikimedia Foundation

[for all processes, in aggregate]

Information

Produced (#) When we say ‘information produced’, we

mean that as a result of a legal process (such as a subpoena) that was legally valid, some or all of the nonpublic user information requested by that legal process was produced by WMF to the requesting party.‘Information produced’ also applies to rare situations where we voluntarily disclose personal information to voluntarily disclose personal information to law enforcement, usually in order to prevent imminent bodily harm or death. Criminal Subpoenas Information Produced (#) Informal Government Requests Information Produced (#)

Court Orders Information Produced (#)

Yahoo

[for all processes, in

aggregate] Rejected (#)

Rejected: Yahoo may have possessed data responsive to the Government Data Request, but none was produced because of a defect or other problem with the Government Data Request (e.g., the government agency sought information outside its jurisdiction or the request only sought data that could not be lawfully obtained with the legal process provided). This category also includes Government Data Requests that were withdrawn after being received by Yahoo. We carefully review Government Data Requests for legal sufficiency and interpret them narrowly in an effort to produce the least amount of data necessary to comply with the request.

[for all processes, in

aggregate] Rejected (%) [for all processes, in

aggregate] No Data Found (#) No Data Found: Yahoo produced no data in response to the Government Data Request because no responsive data could be found

COMPANY

PROCESS /

REQUEST TYPE

RESPONSE

REPORTED

ADDITIONAL INFORMATION /

EXPLANATION OF TERMS

Yahoo (Cont’d)

[for all processes, in aggregate]

Only NCD Disclosed (#)

[for all processes, in aggregate]

Only NCD Disclosed (%)

[for all processes, in aggregate]

Content Disclosed (#)

[for all processes, in aggregate] Content Disclosed (%) Global Emergency Disclosure Requests Percentage of Requests Resulting in Disclosure of Data

In addition to Government Data Requests, Yahoo receives requests from governments seeking information in emergency situations, i.e. the disclosure of information is sought to save a life or prevent serious physical harm. The chart below represents the number of such requests that Yahoo received globally during the reporting period, the number of accounts specified in those requests, and the percentage of the requests that resulted in the disclosure of some information.

MEMO 7: REPORTING ON

USER NOTIFICATION

Twitter‘s report demonstrates the best practice of clear, comprehensive, and granular reporting on

notification of users specified in legal process requests. Reports from Dropbox and GitHub demonstrate

“Approaching Best Practices,” identified on the following page. Approaching Best Practices recognize

reporting that falls just short of the best practices standard(s) but is nonetheless deserving of recognition

for a demonstrated commitment to informative and comprehensive transparency reporting. Additionally

Tumblr’s report demonstrates “Notable Practices,” also identified on the following page. Notable Practices are

innovative, unique, or noteworthy practices, but ones that may not be feasible for all companies.

Few companies engage in the practice of reporting on whether they provided user notice upon receiving or

In document THE TRANSPARENCY REPORTING TOOLKIT (Page 81-98)

Related documents